CVE-2026-92748

BC Security Empire, an open-source command-and-control (C2) post-exploitation framework, fails to validate the multipart filename parameter on its upload endpoints in versions before 6.7.1. An authenticated operator can supply path traversal sequences (e.g., '../') in the filename to escape the intended upload directory and write files to arbitrary paths on the C2 server. Because the write is attacker-directed, an operator can plant malicious files in sensitive locations such as startup or plugin directories to achieve code execution on the C2 server with its privileges. Any deployment running Empire prior to 6.7.1 is affected; the user base consists mainly of red teams and penetration testers, and the framework is also known to be abused by threat actors. No public proof-of-concept is known, the flaw is not listed in CISA's KEV catalog, and there is no confirmed in-the-wild exploitation.

What to do: Upgrade Empire to 6.7.1 or later immediately. Restrict operator accounts to trusted personnel with least privilege, since any authenticated operator can exploit this, and review the C2 server filesystem for unexpected files in sensitive locations (startup directories, plugin/module folders). Limit network exposure of the C2 management/API interfaces to only those who need it.